From f2040b772544ebc434fa82a27713aa3a248c1b45 Mon Sep 17 00:00:00 2001
From: Juan Lang <juan.lang@gmail.com>
Date: Sun, 29 Nov 2009 11:42:57 -0800
Subject: [PATCH] crypt32: Don't copy past end of buffer when removing a string
 from a multi string.

---
 dlls/crypt32/oid.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlls/crypt32/oid.c b/dlls/crypt32/oid.c
index 0a3889d183c..68a48520dac 100644
--- a/dlls/crypt32/oid.c
+++ b/dlls/crypt32/oid.c
@@ -881,9 +881,11 @@ static BOOL CRYPT_RemoveStringFromMultiString(LPWSTR multi, LPCWSTR toRemove)
         }
         else
         {
+            LPCWSTR nextStr = spotToRemove + lstrlenW(toRemove) + 1;
+
             /* Copy remainder of string "left" */
-            memmove(spotToRemove, spotToRemove + lstrlenW(toRemove) + 1,
-             (len - (spotToRemove - multi)) * sizeof(WCHAR));
+            memmove(spotToRemove, nextStr,
+             (len - (nextStr - multi)) * sizeof(WCHAR));
         }
         ret = TRUE;
     }
-- 
2.11.4.GIT